[El Forum]

[eluser]Aaron L.[/eluser]
Hello,

I am trying to submit my form to a function which validates my form before inserting it into the DB. In this function, I am attempting to use prep_for_form (documentation). The problem is, when I fill-in the form with something like "I'm", I still get an SQL error because the ' is there.

Here is my code:

Code:

$this->load->library('validation');

    //set the validation rules
    $rules['subject'] = "prep_for_form|required|xss_clean";
    $rules['message'] = "prep_for_form|required|xss_clean";
    $rules['to_nick'] = "trim|required|xss_clean";
            
    $this->validation->set_rules($rules);
            
    //set field names for validation error messages
    $fields['subject'] = 'Subject';
    $fields['message'] = 'Message';
    $fields['to_nick'] = 'To Nickname';

    $this->validation->set_fields($fields);
            
    if ($this->validation->run() == FALSE)
    {
        echo "Error";
    }
    else
    {  
                $this->db->query("INSERT INTO messages (subject, message) VALUES ('$subject','$message')");

                echo "SUCCESS!!";
    }

Do you know what's going on here? I'm stumped...

Aaron

[El Forum]

[eluser]Christopher Blankenship[/eluser]
htmlspecialchars? For converting the single quote.

Any native PHP function that accepts one parameter can be used as a rule, like htmlspecialchars, trim, MD5, etc.

from : http://www.ellislab.com/codeigniter/user...ation.html

[El Forum]

[eluser]coolfactor[/eluser]
I don't see where you're defining $subject and $message variables. Could that be part of the problem?

[El Forum]

[eluser]Rick Jolly[/eluser]
It is the job of the database library to escape sql.

Either use Active Record or query bindings and the sql will be escaped automatically.

Code:

// query bindings
$sql = "INSERT INTO messages (subject, message) VALUES (?,?)";
$this->db->query($sql, array($subject,$message));

// active record
$this->db->insert('messages', array('subject' => $subject, 'message' => $message));

[El Forum]

[eluser]Aaron L.[/eluser]
Thanks Rick! That is good to know. I've updated my code with an active record insert and it works fine. Thanks again!

[El Forum]

[eluser]Aaron L.[/eluser]
Also, thanks to everyone else for helping.